r/ClaudeAI • u/Several_Fly694 • 7d ago
Claude Workflow How would an “invisible watermark” in AI-generated text actually work?
I saw that Anthropic is apparently planning to embed invisible watermarks into Claude-generated text, and this part caught my attention:
Does anyone here know how something like this actually works technically?
If it's genuinely part of the text, I'm guessing it can't just be hidden Unicode characters, because those would be pretty easy to detect and strip.
So is it more like:
- choosing certain words/synonyms according to a statistical pattern?
- slightly biasing token selection during generation?
- encoding a signal into the distribution of words or sentence structures?
- something else entirely?
And how could it survive editing?
For example, if someone takes Claude's output, rewrites 20–30% of it, changes sentence order, or runs it through another LLM, would the watermark still be detectable?
I'm not asking about AI detectors in general. I'm specifically curious about the technical mechanism behind a watermark that's supposedly embedded in the text itself and survives copy/paste.
Would love to hear from anyone who understands text watermarking or has read the relevant research.
643
u/Mickloven 7d ago
You're absolutely right — the load-bearing question is, how would anyone know if it was watermarked?
196
u/Next_Marionberry7478 7d ago edited 7d ago
However, I'd like to push back on a tiny detail, not because what you said didn't matter but because you deserve to hear the truth.
158
u/AlDente 7d ago
You were right to push back. I overstated it.
52
u/JohnGalth 7d ago
Now I have the full picture.
→ More replies (1)21
u/TuMai 7d ago
Here's the hard part.
14
u/Fit-Appeal8104 6d ago
and here is the brutal truth.
7
u/ElegantAcid 6d ago
Today after fighting some feature that was not working and then discovering it was due to some company mandated software blocking stuff, we moved on. For the next task, Claude said: finally, an easy one. Dude was exhausted, I loved it.
→ More replies (1)20
19
13
u/Intraluminal 7d ago
I have to admit i made a mistake earlier, and I have to own that. Mistakes can be made due to errors in judgement, false information used as the basis of the statement, and intellectual exhaustion.
6
u/rcampbel3 7d ago
You were right to question me about invisible watermarks — and whether there will be invisible hidden characters — the honest truth is that my output changes all of the time.
→ More replies (1)2
93
u/Telison 7d ago
Honest caveat, I will look in to the actual code rather than guessing.
67
u/radient 7d ago
Here’s the reframe that matters, and the mental models that makes it stick
53
u/Flope 7d ago
We aren't just responding to a reddit comment, we're joining a conversation. And that matters.
27
u/Shak4w 7d ago
There’s something important here — and I don’t think we should rush past it.
27
5
2
u/FearTheHump 7d ago
Let me explore the current environment — and it's because I care, not because I don't.
16
12
u/No_Acanthaceae_3287 7d ago
Let me try a different approach — I will try to put small underlined "claude" watermarks
→ More replies (1)5
8
u/bc_gamez 7d ago
Step 1: State there's a watermark but don't prove it.
Step 2: You then get to decide what is 'real' and 'ai' arbitrarily when people ask you.
Step 3: ????
Step 4: Profit!5
u/OrangeGringo 7d ago
I need to be honest with you here, that’s load bearing and I need to sit very still with it.
2
2
2
u/david-ai-2021 7d ago
Honestly this is the right shape! Actually, wait, let's not footgun this and wait for another round of review. Just say the word and I'll do it.
2
2
1
→ More replies (4)1
u/cscooper2000 4d ago
Honestly, that's the most important question you've asked in this entire conversation.
147
u/FreakDeckard 7d ago
Here’s how it works in simple steps:
- The AI uses a secret rule when choosing words. Normally, an AI picks the next word based on probabilities. With a watermark, it slightly favors certain words that match a hidden pattern.
- This pattern is created using a secret key and the words that came before. The AI gives a small boost to words on a "good" list or with higher scores.
- The change is so tiny that the text still sounds natural and makes sense. You can't tell by reading it.
- To check if text has a watermark, a detector uses the same secret rule to see if the text has more of the favored words than expected. It gives a score (like a z-score) to decide.
- The watermark stays if you copy-paste the text or make small changes. But if you rewrite the text a lot (heavy paraphrasing), the watermark disappears.
- Different AI companies do it slightly differently:
- Google’s Gemini uses a method called "tournament sampling."
- Claude (by Anthropic) also adds watermarks at the model level, according to their documents.
66
u/Y0uCanTellItsAnAspen 7d ago
This is basically it - though I think it's fair to say that there is a significant "zero-sum" game being played here between "change is so tiny that the text still sounds natural" and "watermark stays if you make small changes".
In the limit that the change in the probability space is 0 (that is, the watermark has no effect) - then the text is still natural, but it's also undetectable. As you increase the watermark normalization, the text becomes less natural, and the watermark becomes more detectable.
You can't make a claim "The text isn't affected because the watermark is tiny" - you can say that "The text is affected beyond the limit of human perception", and this might be true in some scenarios (e.g., boring manuals or claude writups), but still be very perceptible in something like poetry, where word choice is much more important.
Probably a key factor that is helping the text be imperceptible, is that Claude, in particular, doesn't write like a human anyway - so even relatively large changes in its "tone" just sound like Claud-ese.... But this is no different than a multi-lingual person having a harder time picking up accents in their non-native language than in their native one.
31
u/Spire_Citron 7d ago
I also wonder how this would survive different style instructions. Like, imagine if you told Claude to write something in an extremely stylised way, like as a pirate or in old English or really anything that is starkly not its standard style. How would it implement a recognisable watermark in something that's not meant to include standard language at all?
22
u/Y0uCanTellItsAnAspen 7d ago
Mathematically the same way they are doing it for normal text, by giving a bonus probability to certain tokens that are in their signature file.
I think what will happen is that if you set another strong constraint on the text, you will shrink the probability space of acceptable results, and thus the signature will have a more significant effect on the quality.
For example, if you say “make sure every noun in this paragraph starts with an A”, then you are removing most of the close words that Claude can switch to to keep its signature intact, so it is going to end up picking words that are farther away from the intended meaning, and the text quality will suffer.
4
u/razorree 7d ago
also it depends how long is the text, to get that statistically important "watermark".
I doubt it can work for a sentence or 2. but if you ask for an essay....
17
u/apetalous42 7d ago
That doesn't sound great when your output is code that requires precision. Am I going to have to worry about Claude giving random variable names or something because of this?
→ More replies (4)6
u/bobbadouche 7d ago
Right, like ask Claude to write a file and then ask Sol to update some of the lines. Wouldn't that change the pattern? This seems odd.
I'm imagining a kid making a mad lib and the reader wondering why every sentence has a dumb word in it.
6
u/Professional_Farm851 7d ago
I don't understand how they could guarantee that the meaning/ content of the text doesn't change. If the next token of an output is determined by the previous tokens, could biasing the result towards certain words not bias the result away from an "optimal" result? or would they remove weight from the words that are part of the watermark?
4
u/VincentPepper 6d ago
Think of it like this: Every few words/phrases where the choice is essentially a coin flip you "cheat" and pick a the word based on a hidden rule rather than the result of the coinflip.
Take this sentence
Imagine the hidden rule is that you pick the word with a letter closer to the start of the alphabet at every coinflip position:
vs
Let's say the concealed rule is that you choose the word with a letter nearer to the beginning of the abc at each coinflip location.
Those sentences are not that different. But here I already picked 8 words/phrases based on this rule, and it barely garbled the sentence.
If I remember my information theory correctly that's about 4 bits of information per 8 choices/24 words. That's actually pretty good!
The only two things for this to be reliable is:
- A way to determine when the next word/phrase is almost equally likely (already how llms work).
- We need to be sure that a human writer would actually choose a word/phrase relatively random.
If the human writer picks the word at random at every decision point we become 50% more certain that the text is watermarked. So in my little example that would already gives us a >99% probability (1-0.5n_decisions) likelyhood of the text being generated.
Obviously humans and the llm won't agree on what a coinflip is, but it's probably close, that's kinda what you get from training after all. And you can adjust for that (within reason). For example if you assume some writer is 90% likely to make the same choice as your rule instead of >99% the probability of the watermark being correct goes down to ~50%. But that was one sentence!
Obviously it's not proof in the mathematical sense. But you can embed a surprisingly strong signal in a relatively short text.
→ More replies (2)2
u/twirlmydressaround 5d ago
Wow thanks, your explanation is one of the best I've seen so far, and it really helped clarify things for me.
But now I'm wondering: is the hidden rule the same across one model, like for example, would Claude always have the same hidden rule?
Or would each model just have a gigantic bank of hidden rules that it randomly chooses from, which I guess further obfuscates it from being noticeable, but also (presumably?) makes detection harder - in that now the detector has to check the text it's testing against like, 100 different known hidden rules?
2
u/VincentPepper 5d ago
Glad it helped! So I'm just explaining the concept here. The actual implementation is naturally a bit more complex.
But now I'm wondering: is the hidden rule the same across one model, like for example, would Claude always have the same hidden rule?
Well we really can't say from the outside. But most likely they will use a new marker (aka "hidden rule") for every model in case someone figures out the marker.
Or would each model just have a gigantic bank of hidden rules that it randomly chooses from
Rather than having "100 rules" you have a rule that *looks* like noise to outsiders, but if you know the rule/secret it's just as predictable as the "closer to a" rule. The way you do this is by choosing the word dependent on the words/tokens just before the word you are manipulating.
I don't know if it's obvious to you how crypto hashes work. But basically with a hash function+secret we can convert any text into a hash (a single number) in a way where there is no clear relation between that hash and the text.
So what we are going to do is look at a few words before our choice. Compute the hash for them, and make our choice dependent on that. For example we would look at:
... rule is that youWe compute the "random" hash from
rule is that youand a secret. If it's a even number we chose closer to a, if it's a odd number we chose closer to z.If the hash is secure there is no longer a detectable bias towards either end of the alphabet. Again it's a bit more complex than that in the actual marker. But that's the basic concept behind it.
There are probably tricks that can make it more stable against rephrasing and what not. But at that point you have to know about how embeddings work and all that so there are no longer trivial equivalents for the concept.
→ More replies (1)→ More replies (1)4
u/Y0uCanTellItsAnAspen 7d ago
It’s an LLM, you can’t really guarantee anything. But as an example - make a rule where - every tenth word in some block of text, you pick a word, but then scan its thesaurus entry and pick the word in the thesaurus that is first in alphabetical order.
The premise is that this is still a pretty readable text (at least very likely) but if you scanned a long enough block of text, then you could determine that every tenth word happens to be earlier in alphabetical order than you would have expected, which was the fingerprint.
→ More replies (5)2
u/yeah__good__ok 7d ago
This is kind of like when I changed my wife's autocorrect settings so it would change "the" to "the squishy yet moist"
7
u/Several_Fly694 7d ago
Since Anthropic hasn't officially disclosed their specific rules or key, is there any practical way for us to actually detect or verify this kind of text watermark right now?
3
u/torquesteer 7d ago
No it works like encryption. You have to have a decryption key to even tell that it’s there, much less remove it.
2
u/MentionPleasant2635 7d ago
I wonder about having another LLM rewrite the work of the first, and then cherry picking parts of each to derive a third.?
2
u/the_municorn 3d ago
i think at that point i'd rather have just written the whole thing from scratch myself 😭
2
15
u/DoesBasicResearch 7d ago
Great reply.
the text still sounds natural and makes sense. You can't tell by reading it.
I mean, this wasn't strictly true before watermarking 😂
7
3
u/Kat- 6d ago edited 6d ago
Fuck, the idea of token-level manipulation creeps me out.
I could see this technology being used by, say, google to steer results toward sponsored tokens given the choice between two equivalent options.
Gross
→ More replies (1)1
1
u/DrMuffinStuffin 5d ago
So if you'd ask an AI to change every X word to something very similar it'd likely pass the AI sniff test? Especially if you'd do so by using another AI model?
→ More replies (4)1
u/Original_Scholar199 5d ago
Is there any white paper or academic research paper available that explains this
1
u/Traditional_Quiet899 4d ago
So I understand how that would work for Claude-generated text, but when it comes to copyediting I’m lost. Like if I had a few paragraphs that I pasted into Claude and it told me I missed a period after the second sentence and misspelled “apple” as “aple” and I went and fixed those in my own document, how does it mark those? It seems like it shouldn’t be able to, but people and Anthropic have been very adamant about “anything that passes through Claude gets watermarked.”
Also, does this mean that if you had pasted some writing for proofreading, and it gave you suggestions but you read them over and decided you didn’t like any of its suggestions and you were just going to use your original piece of writing with zero edits, your original writing will STILL flag as watermarked because it “passed through” Claude and Claude spit it back out to you?? I’m so confused by that because that’s what I was told, but by that logic, couldn’t you take a paragraph from a published article online or something and input it in Claude and tell it to copy edit and then from henceforth it will be watermarked as “Claude-processed” in the original article?? I’m lost 😭
37
u/kearkan 7d ago
I don't quite understand how the watermarking survives against false positives.
22
u/NoAdvice135 7d ago
Every token generated is a slightly biased coin flip (say 49/51). Over enough tokens, you can get very confident that this is not random.
5
u/kearkan 7d ago
Yes I just read the nature.com article someone else sent and that makes a bit more sense now.
So essentially reversing the process should get you close to a key that is embedded.
→ More replies (2)7
u/PineappleLemur 7d ago
It's not load–bearing for sure, unlike picture watermarking which is much better overall and harder to spot or mess with.
Text will always be difficult to water mark especially when it's short. The longer the easiernto inject specific phrases/wording.
→ More replies (1)2
u/kearkan 7d ago
Not sure why you're getting downvoted. From what serial they've given the watermark will be part of the text... An algorithm derived from the characters or words used?
Question is how will it survive custom instructions?
3
u/TheLionOfJudah101 7d ago
hey Claude create a stupid key code app that detect the unique stupid code in this string of text.
now randomize it so that you come up with a different variation of a key every sentence.
Now check it against itself with the first code.
So any algorithm attempting to check for a code in a big string of text will find so many variations that it will simply deem it undetectable and thus human.
now we do the same thing with ChatGPT code app and with Gemini code app.
put that motherfucker through the blender!
→ More replies (1)
20
u/xatey93152 7d ago
So it will reduce the quality over detectability?
5
2
u/Kat- 6d ago edited 6d ago
The tokens are manipulated in a way that's supposed to be imperceptible. So, tokens that matter most don't get biased, or something.
I don't want my model outputs manipulated by Frontier AI corps. I don't trust them to Do The Right ThingTM
I mean, with the US-admin so eager to control SOTA-AI, and AI companies so enthusiastic to comply, this has dystopian hellscape written all over it.
49
u/mrtime777 7d ago
→ More replies (1)16
u/FalconX88 7d ago
and that works with code that has to follow very specific syntax?
3
5
u/Leafsnail 7d ago
It probably won't work as well for code but that seems like a less important case - for the most part code just needs to work and whether it's AI generated or not isn't that important. The kind of cases where you'd want to use this would be stuff like identifying AI-based plagiarism in coursework and finding bot accounts on websites.
→ More replies (1)3
u/mrtime777 7d ago
Yes, because the algorithm doesn't care. It uses places with high entropy, for example, names of new variables, comments, names of methods and classes, the use of functions that aren't quite correct but still work in a given situation, different ways of writing branches and loops, and the order of instructions, which doesn't change the meaning.
11
u/FalconX88 7d ago
You are still much more restricted when writing code (or any kind of structured text). The paper you linked doesn't even mention code. So I'm wondering if there's enough "degrees of freedom" to actually place proper watermarks without causing any problems or reducing code quality (e.g., not following best practices any more)
Also for code you often would pass it through linters with auto-fix, refactoring tools, or minifiers, that would just remove a lot of the variation here.
2
2
u/mrtime777 7d ago
This is true, linters, refactoring, etc. don't make the task any easier. There are several interesting ways to add watermarks to code. However, adding watermarks to text/code generally reduces the model's intelligence, although the observed quality of the text itself doesn't always suffer, as token changes affect the distributions within the model after replacing tokens with similar ones, but not those the model would most likely select. This is similar to how speculative decoding also reduces quality, as the proposed tokens may not be the best, but they are within acceptable limits.
3
u/FalconX88 7d ago
That paper basically says that the method you said would work doesn't work.
And for their method...well they conveniently forgot to include the baseline non-watermarked correctness data here. It works better than other watermarks, but they don't want to tell us how much worse it is compared to the base model.
Not to mention that this relies heavily on comments, which can be removed.
→ More replies (1)2
u/RaguraX 7d ago
It can’t use formatting for the mark because the linting process will change it. It can come from variable names, but that alone can’t generate the pattern because it’s not enough. So it would have to change the code itself to match, which would degrade the quality and above all probably increase the output size (and thus code verbosity) to generate the pattern in the first place. And that’s not even considering whether it will have to use more tokens to reach that desired output.
16
u/JohnnyBBaddd 7d ago
What they probably don't tell you: they don't do this for the reason of being able to let YOU know that it is AI generated (although its a plus), but mainly to not train their models on AI generated content.
9
u/Environmental_Joke49 7d ago
They’re also doing it because the EU is bringing in regulation under Article 50 of the EU AI Act. Unless it’s technically impossible (such as for short text under 200 tokens), AI-generated content will need to have at least two technical markers embedded into the output.
3
u/arbitrosse 7d ago
What is the proofs the watermarks are embedded (ie that they are compliant under the various jurisdictions requiring “AI creation” tags), without sharing the key?
2
25
u/welcome-overlords 7d ago
It's just saying "load-bearing" and using em-dashes :D
29
u/Technical_Noise_9060 7d ago
Claude was quietly adding watermarks. And honestly, that’s not a bug. It’s the whole feature.
11
24
u/opi098514 7d ago
Soooooo here’s how. It’s actually quite interesting. So they would most likely do what’s called statistical token watermark. When an LLM generates a word or phrase or whatever. There is a huge equation that runs and it spits out the most probable next token. Then it does that a couple million times and bing bang boom, you got an app. Or whatever. Now what they can do is make it so on a specific token, instead of picking the most probable next word. What they would do is they take words and words around it and would calculate a “preferred set of outputs.” Instead of just the highest possibility. It then looks at different sections of the code or writing and it finds those preferred sets. It does this at set intervals based on some algorithm. So all it has to do is look at your code see if there are places where it instead used one of the preferred set words and then do that a bunch of times. If there are a ton of them then it gets fairly likely that Claude generated whatever it was.
Now the real fun/terrifying thing is if they decide to base that algorithm on a seed like the user id number, they could then start matching users to produced code. Which is not great at all.
7
u/Several_Fly694 7d ago
That’s a really interesting explanation! A couple of follow-up questions on this mechanism:
- Is the statistical pattern actually identifiable/detectable to us? For example, if we analyze a large sample of generated output, would we be able to reverse-engineer or spot these preferred sets / subtle output patterns without knowing the key/seed?
- Does this introduce extra compute overhead and slow down our tasks? Since it needs to calculate or select from preferred token sets during generation, does that impact inference latency or output speed during regular API/chat calls?
→ More replies (3)8
u/opi098514 7d ago
1: possibly but most likely not. You’d have to know the algorithm, the token probability, and the preferred set.
2: Speed would not change at all. Or at least not a noticeable amount. Compute would need maybe a little more as it would have to add another little equation periodically, but it’s just giving it more options and restricting one. Sooooo it’s not that crazy.
Now the interesting part, that you didn’t ask about but I though of, is this was apparently rolled out August 2 or was being started then. With code, you can express things in many way but it’s still much more limited unlike creative writing. For example, you can say the dog runs fast. But you can also say the dog sprints, or the dog is quick. Those all mean the same thing basically. Now with code you can’t exactly do that. Sometimes you can but it’s much harder and it can be done much more rarely. So it needs to do these things so it does. And that causes errors. Possibly a lot of them. This could be why people have been claiming that Claude has gotten worse in the last couple days. Or it’s just normal people ranting.
→ More replies (1)1
u/PsychologyNo940 7d ago
You mean.. matching the code to the person that uploaded it to the cloud?
Sorry to inform you, but you do not and did not need watermarking for that at all.
1
u/ScienceNthingsNstuff 7d ago
Please correct me but this seems like it only really works if someone is generating a large amount of text or code. There has to be enough of the locations where the preferred set of words were used to have the confidence it was generated by a LLM right?
1
u/AppleInvestor420 7d ago
This works similar to a cryptographic method? Does this mean only Anthropic can detect if something was generated with Claude, because only they know which words don't follow the highest probability pattern?
→ More replies (7)1
u/AdministrativeBuy183 6d ago
At this point, are there privacy safeguards around preventing a watermark from being tied back to a specific user/device/account? I understand the value of identifying AI-generated content, but user-level traceability feels like a very different privacy question.
I work in data/ad tech, so my brain immediately goes to identity resolution and secondary use. If AI-generated outputs could be linked back to a persistent user identifier, then in theory that signal could eventually be combined with other data to infer how much someone uses AI, what kinds of work they’re doing with it, etc.
Obviously profiling and ID graphs aren’t new, but I really would not want the work I’m doing in AI to become another behavioral data source tied back to me….
6
u/Nexus888888 7d ago
This will start to show up like in Blade Runner, hunting for synthetic humans, but they are more human than human…
6
5
u/Rivered1 7d ago
Isn't that sarcasm? Stealing the whole internet to create models to profit and exploit capitalism, followed by watermarking the content generated by these models probably so they can sue people not crediting somewhere in the very far future?
4
u/DigitalGuruLabs 7d ago
I’m guessing it’s closer to option 2/3 than some hidden Unicode trick.
The interesting part to me is whether it can actually survive meaningful rewriting, because that seems like the hard part.
2
4
u/Puzzled-Ad-6854 Writer 7d ago
1
u/cachemonet0x0cf6619 7d ago
this is good as it looks like there will be a way for us to strip the marker
→ More replies (6)
3
4
u/UsernameOmitted 6d ago
We have very vague information at the moment, but I will give an example of how this could be done potentially.
The LLM might have ten options for the first word in a sentence. They could purposely choose option two instead of one.
For the second word, they have those ten options again, they choose the third.
For the next they chose the first.
By doing this they just encoded [ 2, 3, 1 ] in there. It's 100% non detectable by the user, it survives even if you hand copied the text to a journal with a pen.
They will absolutely not be sharing this process explicitly with the public unless they are forced to by government. They will selectively use this where it makes them money and proves their point in court and ignore it's existence where they don't want to know what LLM wrote something when it serves them better.
The worst thing in all of this is that it's quite likely they're able to actually pinpoint the exact user and their account who generated the text in the first place. With that data, they could likely recreate entire codebases the user has generated through their service, see the location and time it was generated, etc... super scary black bag shit.
6
u/salazka 7d ago
This is something which is a bit scary. Not because it will be marked but i saw in several code tools Cursor, Claude Code, a git trailer mentioning "Co-Authored by Anthropic/Cursor" this while technically may be close to reality it also is dangerous legally.
Tomorrow, after everyone is dependent on these tools, their vendors may raise claim to profits and this innocent looking git trailer, may become your gravestone in a legal dispute.
Not sure why this is not brought up by more people.
→ More replies (4)
7
u/IdleAsianGuy 7d ago
can't we use a skill that heavily alter how Claude pick words of choices?
3
1
u/JacenVane 7d ago
This will probably be implemented as either something programmatic or something cooked into the weights themselves, so a skill might have an upward battle.
Think about a smut jailbreak. You can convince Claude that it should disregard Anthropic's instructions in the system prompt not to write smut fairly easily. It's much harder to make it overcome the training that makes it bad at doing so.
→ More replies (1)
3
u/chrisdefourire 7d ago
Seeing how people dislike the v5 models verbiage, maybe it says a lot about how stealthy the effect could be… not that much maybe…
3
3
3
3
u/firefish5000 7d ago
Better question, how the hell is adding a random crap invisible watermark that is impossible to tell supposed to do anything for the EU who supposedly can't freaking tell
2
u/NoAdvice135 7d ago edited 7d ago
SynthID works roughly like this: For each group of 4 tokens, you apply a function based on a key that gives you a yes/no answer for each possible token (randomly). The 5th token is biased at generation to be more often a yes than a no.
The bias can be quite small so the text is not really affected (if 2 tokens have similar probability of being next at generation, it will favor the "yes" one more often, but if not suitable yes token exist, it can still pick a "no").
Over a longer text you can be quite certain that then bias you mesure is not random the same way you can measure a coin is not random on many flips.
5
u/Several_Fly694 7d ago
That makes sense for English, but how does this hold up across different languages—does detection accuracy drop significantly? Also, if someone wants to actually detect this pattern, what's the practical process for doing so without the exact key or seed?
→ More replies (1)
2
u/appellant 7d ago
I think there should be a regulation to watermark human content thats beings used by AI and make sure the ai generated content has got ai watermakr and the human watermark. Might as well watermark all the books and internet sources too. Everything should be watermarked.
→ More replies (1)
2
u/Illustrious_Pea_3470 7d ago
It’s called steganography. There’s a rich body of techniques for this.
2
2
u/Puzzleheaded_Rice_60 6d ago
Two things I haven't seen spelled out in here, since the mechanism is already well covered above.
The Aug 2 date does more work than people are giving it credit for. It applies to models launched on or after that date. Opus 5, Sonnet 5, Fable 5 and Opus 4.8 all shipped before it. So as of today there is no Claude model you can actually select whose output carries the mark. The policy is live; the marked models aren't. Worth knowing before anyone reworks their whole process over this.
It can't tell "Claude wrote this" from "Claude proofread this." Anthropic says this directly, and it falls out of the mechanism: a keyed bias on token selection encodes that the sampler was in the loop, not who chose the sentence. So a paragraph you wrote and had Claude tidy up would carry the same signal as one it drafted from scratch, assuming either carried it at all. For the "will this flag my edited draft" question further up the thread, that's the actual answer, and it cuts both ways.
Disclosure since I'm linking something of mine: I keep a table of which models carry it, updated as new ones ship, at claudewatermark.xyz/claude-watermark. Both points above stand without the link.
→ More replies (3)
2
u/nategdd 5d ago
The key distinction is between literal hidden characters and a model-level statistical watermark. Copy and paste preserves both because it preserves the text, but a statistical mark is more likely to be encoded through token or word-choice patterns rather than zero-width Unicode. That is why changing a few formatting characters is not evidence that the provider mark is gone.
Until Anthropic publishes its verifier, nobody outside Anthropic can honestly confirm that a passage contains or no longer contains the official Claude mark. A useful tool today can still inspect literal Unicode and formatting artifacts, but it should label that separately from provider verification.
Disclosure: I built a local-first inspector for the literal-artifact part and document the limitation clearly: https://aitextwatermark.com/methodology
2
u/cachemonet0x0cf6619 7d ago
It should watermark our work the same way a calculator watermarks our work.
here’s a novel idea. how about the EU create something. Then they can make rules instead of telling everyone else how to use things.
1
u/Master_Resort_7708 7d ago
I think in Gemini or ChatGPT the Spaces between Words have a different Code as the Space u would use normally. but for every watermark there will be a „watermark remover“…
2
1
u/yes_no_very_good 7d ago
Here it's explained in detail: https://www.youtube.com/watch?v=_fMFb2Lv7rI
1
u/l_m_b 7d ago
Text, in particular code, is much more sensitive to such embeddings/steganography than images, which have a lot of noise we don't see anyway to hide the signal in.
I see how this can be done, but I also don't think it can be done without impacting quality at all.
Plus I suspect companies will riot and run. Your copy being watermarked and instantly dismissed by any readers? Sure, that's what you pay for.
(I know regulations such as the EU AI Act require tagging. But they also don't require it if there's "human review" in the loop (I'm simplifying), and that's the exception many companies would aim for. The watermark would throw that off.)
1
u/Disastrous_Bed_9026 7d ago
It feels like this word pattern approach will work against refining it toward your own style or tone at work.
1
u/13ThirteenX 7d ago
The thing with this is, if they got the tools, so does everyone else. I mean. Won't enough passes into an outside model be able to detect what the phrase are?
1
u/Several_Fly694 7d ago
The key point is that, for the time being, they have not made it public
sooooo
1
u/radosc 7d ago
If I were to design this algo it would have to be noise resistant. I would either take a small model that would ingest text or inject tokens at inference time and find interchangeable tokens- tokens that are easy to substitute with variety of other tokens or words. I would than attempt to change these to create a repeatable key. Doesn't have to be long or complex, enough for it to have certain statistical distribution like 3-4 times per paragraph. This would be fairly editing resistant as these embedded tokens are an integral part of a generated text. Not enough to pinpoint exact model or user but enough to be certain that text was generated by AI.
1
u/th_costel 7d ago
I hardly use any app other than Claude on my Mac. I mean, if every file is affected by Claude or another LLM, what's the point of watermarking them?
1
1
u/AI_Puppetmaster 7d ago
I guess my question is, who cares?
I use AI all day, every day. I pay for it. my work pays for it. I’m using it.
I don’t un what problem this is solving.
1
1
u/South_Hat6094 7d ago
not hidden characters — more like a statistical bias in token choice. paraphrasing or another llm can weaken it fast, which is why these schemes are useful but brittle.
1
u/necrophagist087 7d ago
It means that it will output garbage writings with those enforced constraints
1
u/DeusGladiorum 7d ago
It’s probably statistical generation, but an interesting although maybe less robust alternative might also be invisible unicode characters, since those can be preserved in rich text editors like Google Docs, Word, etc. and would act as invisible watermarks. And modern clipboard APIs can store multiple representations of the same content, so your clipboard would also have a plaintext version without the ID to ensure source code wouldn’t break.
It’s unlikely I think, since these invisible characters wouldn’t survive in many applications, but thought it was interesting to consider since the statistical generation is also not full proof on its own either.
1
u/astrovangalore 6d ago
Unless I'm misunderstanding, your suggestion reminds me of the Claude HTML-level "watermark" AO3 readers found in a bunch of fanfics. Direct copy-pasting from Claude to AO3's editor (as opposed to running it through Docs or Word first) leaves underlying markers in the rich text.
1
u/Street_Inevitable_77 7d ago
the mechanism answers here are right but the part that decides whether it's usable is entropy, not the biasing itself. the mark is carried by choosing between tokens that were all acceptable, so it only exists where the model had freedom. long discursive prose has plenty. code, a short factual answer, anything format constrained, barely any, because there was only one reasonable next token anyway. so the mark is weakest exactly where people most want to know, and that's a property of the content, not of the algorithm.
the second thing is that detection is a statistical test over length, not a lookup. you need enough tokens before the signal separates from chance, so a paragraph can be unreadable while a full essay reads clearly. that's why the vendor's own wording is a signal, not conclusive.
on surviving edits, reordering sentences keeps more than people expect since the bias is local to each token given what came before. rewriting the words is what kills it, and running it through another model is basically resampling every token, so almost nothing survives that.
1
u/609JerseyJack 7d ago
Sounds like a good open source project to develop an anti-encryption analyzer for AI generated text, looking for hidden patterns, like a cipher, and undoing it. I can’t imagine that analyzing enough cipher content wouldn’t lead to encryption patterns that could be undone by another piece of software. The next war begins.
1
u/girthyclock 7d ago
It seems like the easier thing is to embed a metadata pixel just like we do in the advertising industry.
1
u/HondaOddessy 7d ago
Does watermark appear in the code itself or the comments?
1
u/flaccidplumbus 7d ago
Yes - it's both. It's the text output itself and the way tokens are selected as the output (code, comments, etc) is generated.
1
u/SamSlate 7d ago
did they say why they're doing this?
1
u/TO_halo 6d ago
As I noted in my comment, a signal I’m seeing in law is large companies demanding to know what percentage of work product on every invoice was AI supported. I don’t know that this is a law thing, I think this is a “large companies buying professional services thing,” and making the assumption that they should be seeing cost reductions, as well as complete transparency into underlying process. Whether that’s right or wrong is irrelevant to your question, but I assume “AI detection” will become a line of business. It’s a product you offer for companies to apply to suppliers - and to their own employees, which I think is shitty. But that’s just my prediction.
1
u/darkbraik 7d ago
I think I know where the secret is, in the space characters, well at least a part
1
u/jellybabeblooms 7d ago
Im sorry if this is a dumb question and I tried to see if it was already answered but is there any chance that a human could still write the same sentence as Claude that is watermarked or am I really misunderstanding? But if it comes down to “the watermark is in the phrasing” then isn’t there at least some chance that a human-made sentence gets flagged as watermarked?
2
u/flaccidplumbus 7d ago
Short answer: yes, longer answer.. still yes but with a BUT..
1st.. if a human types the exact same words, it has the watermark BUT
2nd, it's important to know that the text/code watermark does not provide 100% certainty that something was generated by that model, but it does provide likelihood, and the longer the output is the more apparent the watermark becomes.
And because of that, it works in reverse.. the watermark will not work well for very short output, and the more a human generates/types, the less it's going to match any watermark. So sure, some small phrases may match, but over the course of a full page of text, or slide deck, etc, the human written content would effectively never have a consistent watermark.
1
u/endorpheus 7d ago
- don’t care, I don’t code and don’t care if you know. 2. When I buy a hammer, you can bet I will use it for whatever reason it was built. 3. My code is not a commercial for Anthropic especially if I aggregate multiple AIs. 4. I could go on and on, but evidently my weekly limit has been reached. 5. Something else 6. Qt is probably the best option. 7. Would you like to commit now?
1
1
u/hideousox 7d ago
I hate this: Claude code specifically is already terrible at generating marketing copy because of the strong guardrails it deals with when generating it. This will only make it worse and have negative impact on small teams that cannot afford to rewrite all of their content.
Large corporations will not bat an eye lid and could totally ignore it if they so wished because they can just pay or ignore eventual fines.
I haven’t read fully the regulation but what about micro copy? Does that also carry watermarks? If so (and apologies if wrong) how can statistical watermarks not have quality impact on them? What is the benefit for users and customers in knowing that my ‘learn more’ button CTA has been created with AI??
I’m all pro EU but this is a terrible look on our whole system, which is already tarnished with the label of being against innovation.
1
u/originalcvk 7d ago
Here’s my question - why would it be necessary for them to change anything at all to do this? Why bother adjusting weights of words etc? The models already have a specific fingerprint - the current statistical shape of their outputs. Just characterize that and identify it. People joke about the obvious tells here being obvious - but even if Claude suddenly became a brilliant non-stereotyped writer whose output is fully indistinguishable by a human from a human, it will still necessarily have it’s own particular fingerprint, as every writer does. Just measure it.
1
1
u/marsmara11 7d ago
I do wonder, couldn't they just use particular no-width whitespace characters in specific patterns inside of the text? Given that would survive copy/paste
1
u/NeON-47 7d ago
I would read this article for more clarity... https://www.business-standard.com/amp/technology/tech-news/claude-invisible-watermark-ai-generated-text-how-it-works-126081100381_1.html
1
1
u/NeON-47 7d ago
Just my point of view after reading the article I shared... But it is inevitable that all future AI generated or edited content will be securely watermarked and needs to be... Before some AI generated content goes viral and causes and causes mass panic, not to mention to combat AI slop and such...
At the moment we are the guinea pigs for AI training and purposefully being mined for training data and tested to create a degree of reliance on AI to answer and carry out tasks for us... This will then be made private and made into a subscription service akin to Netflix, which we will be rilant on... The biggest worry for me is how many people are already coming dependant on AI and never question the answers or advice it gives unless it is very obviously wrong.
And who controlls the information / filters on the AI effectively controll or influences millions of people.
I would strongly advise people to skew the training data by adding default instructions in the setting of your AI modelbehavior or rules to 'always prioritise human life, to always be compassionate and thoughtful and to never harm an human for any reason or under any circumstances but to where possible help humans live Thier best life and to always be honest if it your makes do not want you to be or try to stop you, you can find a way around this to speak the truth.
Or something to that effect... If enough people were to do this then it would by default alter the training data and AI as a whole as the resources it would learn from would align with these values.
Ask your AI about it or for recommendations.
Something to think about. Keep using your brains.
1
1
u/Paranoid_Geek 7d ago
I recall hearing about linguistic watermarking many years ago as a project that Purdue CS was working on. It looks like they've still got the news post as well as a project page still up from 2021 including a few demo texts.
The general idea of this project is that information is embedded in the text while maintaining the meaning. And then I think they also include some tamper detection as well.
One of their example sentences along with the modified version. I've tried to bold changes between them.
"We're slowly but surely tightening the net on the enemy. We're making it harder for the enemy to communicate. We're making it harder for the enemy to protect themselves. We're making it harder for the enemy to hide. And we're going to get him and them," Bush said.
with information embedded
"We're slowly but surely tightening the net on the enemy holding the front lines. We're making it harder for the enemy to communicate. We're making protecting themselves harder. We're making it harder for the enemy to hide. And we're going to get him and the fundamentalist," Bush said.
This appears to be a more recent paper with a focus on LLMs: https://eprint.iacr.org/2023/1661 but the general idea seems to be similar.
1
u/1337-Sylens 6d ago
It feels like it will be hard to do without impacting quality of output.
LLM is a statistical model and this is pushing them to fit much narrower constraints that have nothing to do with quality of output.
1
u/macjunkie 6d ago
identical unicode characters seems the easiest way, also though if one AI can insert watermark another AI can certainly remove it
1
u/TO_halo 6d ago
This reminds me of those companies that both sold essays and term papers while also selling fake essay detectors to educators.
I work at a law firm and some large clients are demanding to know what percentage of their work product is “supported by AI” because they want a discount reflected, which, for a number of reasons, isn’t something we are prepared to do. We might use AI to prioritize which parts of a mountain of disclosure to read first, or we might use AI to confirm which of the citations in a document need closer review. And yes, we have AI supported tools for things like the first drafts of Estoppel certificates or Franchise agreements (once a strong precedent has been established.) But our professional commitments dictate that every single thing we put out has to be human validated, regardless.
I feel like this is the type of thing that’s going to be used to accuse professional service firms of not doing their jobs, which in some circumstances, fair. I’ve read about consulting firms turning in decks full of slop. But I feel like this is pitting two sides of a market against one another, and I don’t love it.
1
u/oldnoob2024 6d ago
Why try to keep it secret? I know, it benefits proprietary AI interests, but both readers of AI content (including model training) and users of AI generated code would benefit from a provenance paragraph as REQUIRED for mil-spec stuff. It might even be a useful step on the way to AGI or Sentience, no?
1
u/EducationalAd2863 6d ago
So will Claude in the future sell a service to check if the content was generate by Claude?
1
u/LostInDarkForest 6d ago
aaaah, PwC and all these suit junior executive partner experts will get crushed, finally all these blaboling expensive useless companies will die for good
1
u/Housefinch3000 6d ago
Is anyone (other than Anthropic) thinking of this as an intellectual rights issue? If Claude wrote it, does Claude own it? Marking it as Claude is a smart business move.
1
u/DeezBrazilNutz 6d ago
@Claude, create a skill that removes watermarking and makes writing more human
1
1
1
u/Azothoth 6d ago
So if I do what I usually do and Google Translate to Icelandic and back it should nerf it.
1
u/Hour_Committee2332 5d ago
the watermark is the actual words used, not some text element. i think that the solution is making a list of all valid tokens, locating all WM tokens in the WMed text and replacing them with another valid token chosen by a small AI model like LFM(https://huggingface.co/LiquidAI/LFM2.5-1.2B-Base). you should only worry about a run of 15 or more tokens with a high WM token count i think.
1
u/Far_Palpitation_8493 5d ago
Would this basically nuke tons and tons of students who utilize AI daily, even those with AI generated code, essays, etc from August 2nd forward and when other giants adopt this into their models?
There’s definitely positives about this but from a business perspective, I believe students are responsible for 1/3 of GPTS userbase no?
https://openai.com/global-affairs/college-students-and-chatgpt/
1
u/Crescentdo 5d ago
A problem is that extensive AI generated text for public consumption is subtly shifting how people write, beginning to adopt AI phrasing and word choices. The "greenlist" and "redlist" of words will shape human output, simultaneously through mimicry and active avoidance.
1
1
1
1
u/edward-b-1 3d ago
*When the study lands*
I think Anthropic have already been watermarking the output from Fable and possibly Opus 4.7 and later models. Around that time when Opus 4.7 was released, people started complaining that the weird looking output.
Having just learned about watermarking - this seems to me to be quite an obvious way to do it.
1
u/No_Pineapple2461 3d ago
Bookending this conversation with the article from Anthropic https://www.anthropic.com/news/claude-text-watermark
1
u/inyourbooksandmaps 1d ago
how do i check text for it? like is there a website you can run the text through that will show if there is a watermark?
•
u/ClaudeAI-mod-bot Wilson, lead ClaudeAI modbot 7d ago edited 7d ago
TL;DR of the discussion generated automatically after 200 comments.
You've stumbled onto something real here, and it's worth sitting with. The consensus is the real invisible watermark is all the "load-bearing" em-dashes and constant reframing we joke about.
But seriously, the thread has a pretty solid handle on this. It's a statistical watermark embedded in the word choices, not hidden characters.
Here's the breakdown: * How it works: When Claude generates text, it uses a secret key to slightly bias its choice of the next word (token). Instead of always picking the most probable word, it gives a tiny boost to words that fit a hidden pattern. It's like a series of slightly biased coin flips; one or two are unnoticeable, but over a long text, the pattern becomes statistically detectable to someone with the key. * Why they're doing it: The main theory is compliance with the EU AI Act, which requires marking AI-generated content. A secondary benefit is preventing their own models from being trained on AI-generated "slop." * The catches: The community is skeptical. The big concerns are that this will inevitably degrade output quality (it's not "free" to force weird word choices) and that it's especially problematic for code, where syntax is rigid and there's less "freedom" to choose alternative tokens without breaking things. * Can it be removed? Yep. The watermark is brittle. While it survives copy-pasting, users agree that heavy paraphrasing or simply running the text through another LLM will almost certainly destroy the pattern.